research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflow explicitly instructs the background sub-agent to query Argus and then "extract full content" from RESULT_URL via the local Argus /api/extract endpoint (see Mode 1 Task steps and curl examples), which causes the agent to fetch and ingest public third‑party web content that could contain untrusted/user‑generated instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The subagent prompt issues runtime curl calls to Argus endpoints (http://localhost:8005/api/search and http://localhost:8005/api/extract) to fetch and inject external content into the agent's research context, meaning those URLs are used at runtime and directly influence the agent's inputs.